Discover our new Gift Sets!

Choose 3 free samples with every order!

Free shipping when you spend £50 or more!

Split your purchase into 3 payments with Klarna!

Home - Privacy Policy

Privacy Policy

Information provided pursuant to Art. 13 of Regulation (EU) No. 2016/679 (GDPR)

 

  1. WHY THIS NOTICE

This page describes the processing of personal data carried out by the undersigned company with regard to all types of data subjects (hereinafter referred to as “data subjects”, pursuant to Art. 4, c.1 of the GDPR), with the aim of outlining the Company Policy adopted in order to ensure compliance with the provisions of GDPR 2016/679, Legislative Decree 196/2003, Italian provisions on this matter, Guidelines issued by the European Data Protection Board and Community Directives on the protection of data of natural persons.

This privacy policy is provided pursuant to Art. 13 of Regulation (EU) 2016/679 for those who enter into any form of relationship with the undersigned.

 

The Privacy Policy of this website does not refer to any other forms of processing carried out or described after browsing websites via links that may be found through this website.

 

  1. DATA CONTROLLER
  • the Data Controller is the undersigned Company:

Davines S.p.A.

Registered office

Via Don Angelo Calzolari 55a

località Roncopascolo

43126 Parma (Sezione Golese)

Phone: +39 0521 965611

Fax: +39 0521 292597

E-mail: info@davines.it

 

  • the Data Controller has appointed a Data Protection Officer (DPO) who can be contacted to exercise all the rights set out in Articles 15 to 21 of the GDPR: the right of access, the right to rectification, the right to erasure, the right to restriction, the right to data portability, the right to object, and the right to revoke a previously granted consent; if their requests are not met, data subjects may lodge a complaint with the Data Protection Supervisory Authority (pursuant to 13(2) point d) of the GDPR).

DPO contact details: privacydpo@davines.it

  • all data is processed lawfully, correctly and transparently in relation to the data subject, in accordance with the general principles set out in Art. 5 of the GDPR;
  • specific security measures are observed to prevent data loss, unlawful or incorrect use and unauthorised access.

 

  1. TYPES OF DATA PROCESSED

 

  • DATA FOR CONTACT REQUEST

The optional, explicit and voluntary sending of personal data required for contact requests through the forms available on this website, or through any e-mail addresses provided on this website, involves subsequent acquisition of only the data that are necessary to reply to the requests sent.

For further information, please email the relevant address or info@davines.it

Purpose and legal basis of processing

(GDPR Art.13(1), point c)

These data are used for the sole purpose of replying to requests for information sent by filling in the forms.

Scope of communication

(GDPR Art.13(1), points e and f)

The data are processed exclusively by internal personnel, which are duly authorised and trained to process such data (GDPR Art. 29), which will not be disclosed to external parties, disseminated or transferred to non-EU countries. Only in the event of an investigation may they be made available to the competent authorities. If this is not the case, it shall be specified in the relevant form.

Processing methods

(GDPR C. 39)

Personal data are processed by automated tools for the time strictly necessary to achieve the purposes for which they were collected.

Specific security measures are observed to prevent data loss, unlawful or incorrect use and unauthorised access.

Period of data retention

(GDPR Art.13(2), point a)

Data are generally stored for short periods of time, for the sole purpose of fulfilling the requests received.

Provision

(GDPR Art.13(2), point f)

Data are provided voluntarily by the data subjects.

Lawfulness

(GDPR Art.6(1) 

Data processing is necessary in order to reply to the requests received, therefore consent is given by filling in the forms.

 

Although our website does not contain any content that cannot be viewed by minors, we would like to point out that when filling out the request form on the “CONTACT US” page, no personal data should be entered by minors without the prior consent of their parents or guardians. DAVINES S.p.A. strongly advises all parents and guardians to teach minors how to use their personal data safely and responsibly on the Internet. DAVINES S.p.A. undertakes not to retain or deliberately use any personal data entered into the form by minors for any purpose whatsoever, including disclosure to third parties.

 

  • DATA FOR APPLICATIONS

The personal data communicated by the data subjects by voluntarily mailing their CVs using the e-mail addresses provided, or acquired by filling in specific forms, are processed for purposes such as scouting, recruitment and the management of potential future employment relationships. 

For further information, please email the relevant address or info@davines.it

Purpose and legal basis of processing

(GDPR Art.13(1), point c)

Personal data sent by the data subject by sending a CV or filling in the fields provided for this purpose.  The data are processed prior to entering into a contract, for the purpose of pre-contractual activities leading to the formalisation of a possible employment contract and related legal obligations.

Scope of communication

(GDPR Art.13(1), points e and f)

The data are processed exclusively by internal staff, employed by the HR Department, which are duly authorised and trained to process them (GDPR Art. 29) and will not be disclosed to external parties, disseminated or transferred to non-EU countries. In other cases, it will be specified in the relevant form.

Period of data retention

(GDPR Art.13(2), point a)

Data are retained for two years

Provision

(GDPR Art.13(2), point f)

The provision of personal data is optional; however, failure to provide such data and to give consent to their processing may make it impossible for the company to correctly assess the position for the purpose of recruitment and, as a result, make it impossible for the company to manage the application.

 

  • DATA FROM CONSUMERS/END USERS, CONTACT PERSONS OF CUSTOMER COMPANIES, CONTACT PERSONS OF SUPPLIER COMPANIES

The personal data provided by the specified parties, or collected by the undersigned while carrying out activities arising from contractual relationships, stem from the need to perform the activities organised between the parties. 

For further information, please email the relevant address or info@davines.it

Purpose and legal basis of processing

(GDPR Art.13(1), point c)

Data are collected and used in such a way as to:

-        enter into contractual/professional relationships,

-        to fulfil pre-contractual, contractual and fiscal obligations arising from existing relationships and to manage the necessary related communications;

-        to fulfil the obligations imposed by law, a regulation, Community legislation or an order of the Authority;

-        to exercise a legitimate interest and right of the Data Controller (such as: the right to legal defence, protection from creditor claims, routine in-house operational, management and accounting requirements).

Scope of communication

(GDPR Art.13(1), points e and f)

The data are processed exclusively by internal personnel, which are duly authorised and trained to process such data (GDPR Art. 29), which will not be disclosed to external parties, disseminated or transferred to non-EU countries. If this is not the case, it shall be specified in the relevant form.

Processing methods

(GDPR C. 39)

Personal data are processed automatically and on paper.

Specific security measures are observed to prevent data loss, unlawful or incorrect use and unauthorised access.

Period of data retention

(GDPR Art.13(2), point a)

Data are normally retained for short periods of time that are strictly necessary to fulfil contractual or regulatory obligations.

Provision

(GDPR Art.13(2), point f)

Data are requested by the undersigned for the specified purposes.

Lawfulness

(GDPR Art.6(1) 

Data processing is necessary in order to establish contractual relations, which means that consent is not required.

 

  • DATA FOR SUBSCRIPTION TO INFORMATIVE NEWSLETTERS

The personal data provided by data subjects by voluntarily entering their contact details in the online form are processed for purposes such as sending newsletters. 

For further information, please email the relevant address or info@davines.it

Purpose and legal basis of processing

(GDPR Art.13(1), point c)

The information gathered is used to identify data subjects in order to provide information by sending out newsletters or in any other way described in the relevant form, and regarding products/services.

Scope of communication

(GDPR Art.13(1), points e and f)

The categories of data processors who will process the data for the above-mentioned purposes are those who manage the website, customer service and information systems, along with third-party companies (GDPR Art. 28) that carry out the relevant data processing on behalf of the undersigned (including, by way of example but not limited to, IT service maintenance, etc.). The collected data may also be communicated to the authorities legitimately entitled to receive them.

The data are processed exclusively by staff, which are duly authorised and trained to process them (GDPR Art. 29) and will not be disclosed to external parties, disseminated or transferred to non-EU countries. If this is not the case, it shall be specified in the relevant form.

Processing methods

(GDPR C. 39)

Personal data are processed by automated means.

Specific security measures are observed to prevent data loss, unlawful or incorrect use and unauthorised access.

Period of data retention

(GDPR Art.13(2), point a)

Data are normally stored until data subjects withdraw their consent.

Provision

(GDPR Art.13(2), point f)

Data are voluntarily provided by the data subject when subscribing to informative newsletters.

Lawfulness

(GDPR Art.6(1) 

Data processing is optional for sending informative messages; therefore, they are sent only after consent has been given.

 

  • DATA FOR SUBSCRIPTION TO COMMERCIAL NEWSLETTERS

The personal data provided by data subjects by voluntarily entering their contact details in the online form are processed for purposes such as sending newsletters. 

For further information, please email the relevant address or info@davines.it

Purpose and legal basis of processing

(GDPR Art.13(1), point c)

The information gathered is used to identify data subjects for marketing purposes and to carry out promotional activities by sending newsletters or in any other way described in the relevant form, regarding products/services purchased or other types of products/services, novelties and promotional offers of the undersigned.

Scope of communication

(GDPR Art.13(1), points e and f)

The categories of data processors who will process the data for the above-mentioned purposes are those who manage the website, customer service, marketing activities and information systems, along with third-party companies that carry out the relevant data processing on behalf of the undersigned (GDPR Art. 28). The collected data may also be communicated to the authorities legitimately entitled to receive them.

The data are processed exclusively by staff, which are duly authorised and trained to process them (GDPR Art. 29) and will not be disclosed to external parties, disseminated or transferred to non-EU countries. If this is not the case, it shall be specified in the relevant form.

Processing methods

(GDPR C. 39)

Personal data are processed by automated means.

Specific security measures are observed to prevent data loss, unlawful or incorrect use and unauthorised access.

Period of data retention

(GDPR Art.13(2), point a)

Data are stored for up to 24 months after being collected, after which consent is renewed if the data subjects are interested.

Provision

(GDPR Art.13(2), point f)

Data are voluntarily provided by the data subject when subscribing to promotional/commercial newsletters.

Lawfulness

(GDPR Art.6(1) 

Data processing is optional for receiving promotional/commercial messages; therefore, they are sent only after consent has been given.

 

  • BROWSING DATA

During normal operation, the computer systems and software procedures used to operate this website acquire personal data, which are transmitted when using Internet communication protocols. This category of data includes the IP addresses or domain names of the computers used by users connecting to the website, the URI (Uniform Resource Identifier) addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code that identifies the status of the response given by the server (successful, error, etc.) and other parameters relating to the user’s operating system and computing environment.

For further information, please email the relevant address or info@davines.it

Purpose and legal basis of processing

(GDPR Art.13(1), point c)

Such data are used for the sole purpose of obtaining statistical information on the use of the website and to make sure it is working properly. The data could also be used to ascertain responsibility if computer crimes against the website were to occur (legitimate interests of the data controller).

Scope of communication

(GDPR Art.13(1), points e and f)

The data are processed exclusively by internal personnel, which are duly authorised and trained to process such data (GDPR Art. 29), which will not be disclosed to external parties, disseminated or transferred to non-EU countries. Only in the event of an investigation may they be made available to the competent authorities. In other cases, it will be specified in the relevant form.

Period of data retention

(GDPR Art.13(2), point a)

Data are generally retained for short periods of time, unless they are required to be retained for longer periods of time in connection with surveys.

Provision

(GDPR Art.13(2), point f)

Non-identifying data are collected independently, with no need to request consent.

Identifying data is optionally provided by the data subject after giving consent.

 

  • DATA FOR REGISTRATION TO THE ONLINE SHOP

The personal data provided by the data subjects when filling in specific forms for activating accounts are processed for the purpose of registering users on the Shop Online website.

For further information, please email the relevant address or info@davines.it

Purpose and legal basis of processing

(GDPR Art.13(1), point c)

Data subjects are required to provide personal data in order to process registration requests on the Shop Online website. The provision of the data contained in the registration and/or product purchase form, along with the additional personal data required for the purpose of payment and for delivering the goods, is aimed at processing the order and finalising the contract.

Scope of communication

(GDPR Art.13(1), points e and f)

Authorised data processors who will process the data for the above-mentioned purposes include those who manage the website, accounting, customer service and information systems, along with third-party companies that process data on behalf of Davines S.p.A. (including, by way of example but not limited to, IT service maintenance, shippers and carriers, legal advisers, companies involved in the implementation and/or management of promotional campaigns, etc.). Such data may also be communicated to the authorities legitimately entitled to receive them.

In order to get a full list of those in charge of processing the data collected, we invite data subjects to contact our Customer Service.

The collected data will not be disclosed to external parties, disseminated or transferred to non-EU countries. In other cases, it will be specified in the relevant form.

Period of data retention

(GDPR Art.13(2), point a)

The collected data are stored only for the time necessary for the services requested to be provided.

Provision

(GDPR Art.13(2), point f)

It is mandatory to provide data for the above-mentioned purposes so that the services requested can be provided.

 

  • DATA COLLECTED FOR PROFILING PURPOSES

The personal data collected from data subjects are processed for profiling purposes with regard to purchasing habits and/or preferences for the services and/or products supplied by the undersigned. 

For further information, please email the relevant address or info@davines.it

Purpose and legal basis of processing

(GDPR Art.13(1), point c)

The information gathered identifies data subjects for profiling purposes, which therefore relate to their purchasing and browsing habits and/or preferences or other identifying data produced by the devices, applications, tools and protocols used, such as IP addresses, temporary markers (cookies) or other types of identifiers, with the aim of analysing such data and offering marketing services.

Scope of communication

(GDPR Art.13(1), points e and f)

The categories of data processors who will process the data for the above-mentioned purposes are those who manage the website, customer service, marketing activities and information systems, along with third-party companies that carry out the relevant data processing on behalf of the undersigned (GDPR Art. 28). The collected data may also be communicated to the authorities legitimately entitled to receive them.

The data are processed exclusively by staff, which are duly authorised and trained to process them (GDPR Art. 29) and will not be disclosed to external parties, disseminated or transferred to non-EU countries. If this is not the case, it shall be specified in the relevant form.

Processing methods

(GDPR C. 39)

Personal data are processed by automated means.

Specific security measures are observed to prevent data loss, unlawful or incorrect use and unauthorised access.

Period of data retention

(GDPR Art.13(2), point a)

Data are stored for up to 12 months after being collected, after which consent is renewed if the data subjects are interested.

Provision

(GDPR Art.13(2), point f)

Data are voluntarily provided by the data subjects for profiling proposals in the promotional/commercial field.

Lawfulness

(GDPR Art.6(1) 

Data processing is optional for activating the profiling service; therefore, it only takes place after consent has been given.

 

  • DATA FOR REGISTRATION TO DIGITAL EVENTS

The personal data provided by the data subjects when filling in specific forms to register for Digital Events are processed for the purpose of registering for these Events.

For further information, please email the relevant address or info@davines.it

Purpose and legal basis of processing

(GDPR Art.13(1), point c)

Data subjects are required to provide personal data in order to process registration requests for the digital event of interest. The e-mail address will only be used to finalise registration for the chosen events and to send reminders about the event of interest to the data subjects.

Scope of communication

(GDPR Art.13(1), points e and f)

Authorised data processors who will process the data for the above-mentioned purposes include those in charge of organising and managing events, customer service and information systems, along with third-party companies providing support in certain cases, including IT service maintenance, event organisation, etc. Such data may also be communicated to the authorities legitimately entitled to receive them.

The collected data will not be disclosed to external parties, disseminated or transferred to non-EU countries. In other cases, it will be specified in the relevant form.

Period of data retention

(GDPR Art.13(2), point a)

The collected data are stored only for the time necessary for the services requested to be provided in connection with the digital events organised.

Provision

(GDPR Art.13(2), point f)

It is mandatory to provide data for the above-mentioned purposes, for the sole purpose of granting registration for the digital events organised by the undersigned.

 

  • DATA FOR JOINING THE “UGC” SERVICE

The personal data provided by data subjects when filling in specific forms to register and consent to the publication of images on social networks are processed for this purpose.

For further information, please email the relevant address or info@davines.it

Purpose and legal basis of processing

(GDPR Art.13(1), point c)

Data subjects are required to provide personal data for the purpose of following up on statements in which they give consent to Davines S.p.A. to publish their images on Social Networks, and which data subjects have indicated to this effect (“UGC”).

Scope of communication

(GDPR Art.13(1), points e and f)

Authorised data processors who will process the data for the above-mentioned purposes include those who manage the social media pages owned by Davines S.p.A. and information systems, and any third party companies that process the data on our behalf (such as, IT service maintenance of the IT, other forms of maintenance, etc.).

The collected data will not be disclosed to external parties, disseminated or transferred to non-EU countries. In other cases, it will be specified in the relevant form.

Period of data retention

(GDPR Art.13(2), point a)

The collected data is only stored for the time required to publish the images specified for the Davines S.p.A. “UGC” service.

Provision

(GDPR Art.13(2), point f)

The provision of data is necessary for “UGC” Davines S.p.A. to be able to disclose the images.

 

  • COOKIES

You will find more general information on cookies and how to enable and disable them on davines.com website/pages/cookie-policy in the Cookies and Advertising management section.

 

  1. RIGHTS OF THE DATA SUBJECT (GDPR articles 15-22)

At any time, the data subject may exercise the right to:

  • request confirmation of whether or not his/her personal data is being held.
  • obtain information on the purposes of processing, the categories of personal data, the recipients or categories of recipients to whom the personal data have been or will be communicated and, where possible, the data retention period.
  • obtain the rectification and erasure of data.
  • obtain restriction of processing.
  • obtain data portability, which means to receive the data from a data controller in a structured, commonly used and machine-readable format, and to transmit them to another data controller without hindrance.
  • object to processing at any time, also in the case of processing for direct marketing purposes.
  • object to automated decision-making concerning natural persons, including profiling.
  • lodge a complaint with the Italian Data Protection Authority.

 

Requests must be made to the Data Controller via the relevant e-mail address for the processing operations described.

We will make every effort to ensure that the functionalities of this website are as interoperable as possible with the automatic privacy checking mechanisms available for certain products used by users.

 

This informative document is updated as of 16/05/2022.

 

 

 

 

 

 

Subscribe to our newsletter